Auditing a factory's supplier risk assessment process is crucial for ensuring supply chain resilience, compliance, and quality. Here’s a structured approach to conduct a thorough audit:

1. Define Scope & Objectives

   • Identify key suppliers (e.g., critical materials, high-risk regions).
   • Set goals: Verify process effectiveness, identify gaps, ensure compliance with standards (ISO 28000, ISO 9001, industry-specific).
   • Review prior audit reports and supplier incidents.

2. Gather Documentation

   • Supplier risk assessment methodology (e.g., risk matrix, criteria).
   • Supplier lists, risk registers, and periodic reassessment records.
   • Corrective action logs (CAPAs) for high-risk suppliers.
   • Contracts with risk clauses (e.g., ESG, compliance).
   • Third-party audit reports (e.g., Sedex, BSCI).

3. Audit Team & Tools

   • Assemble auditors with expertise in supply chain, quality, and compliance.
   • Prepare checklists, interview guides, and data collection templates.
   • Use tools like risk scoring models, sampling frameworks, and compliance-tracking software.

Phase 2: On-Site Audit Execution

A. Process & Documentation Review

1. Risk Assessment Framework

   • Criteria: Verify if risks cover financial, operational, ESG (labor, environment), compliance, quality, and geopolitical factors.
   • Frequency: Check if reassessments occur (e.g., annually, post-incident).
   • Tools: Assess validity of risk matrices (e.g., likelihood vs. impact scales).
   • Red Flag: Over-reliance on outdated data or inconsistent criteria.

2. Supplier Selection & Onboarding

   • Review due diligence procedures (e.g., background checks, financial health).
   • Verify if risk assessments are integrated into supplier approval workflows.
   • Red Flag: Suppliers onboarded without formal risk screening.

3. Ongoing Monitoring

   • Examine KPIs tracked (e.g., delivery performance, defect rates, audit findings).
   • Check if triggers for reassessment are documented (e.g., new regulations, supply disruptions).
   • Red Flag: No real-time monitoring of critical suppliers.

B. Interviews & Verification

1. Stakeholder Interviews

   • Procurement, quality, and sustainability teams: Ask how risks are identified and mitigated.
   • Suppliers (if accessible): Verify consistency in risk perceptions.
   • Key Question: "Can you provide an example of a high-risk supplier and actions taken?"

2. Site Visits (Optional but Recommended)

   • Audit select high-risk suppliers to validate self-reported controls.
   • Check physical conditions (e.g., safety protocols, waste management).

C. Data Analysis

• Risk Register Validation:
  • Sample 10-15 suppliers and cross-check risk ratings against evidence (e.g., financial reports, audit findings).
  • Ensure risks are prioritized correctly (e.g., high-risk suppliers get more oversight).
• Corrective Actions:
  • Verify CAPAs for high-risk suppliers are implemented and effective.
  • Track recurrence of issues.

Phase 3: Post-Audit Reporting & Follow-Up

1. Findings & Recommendations

   • Document gaps (e.g., "No ESG risk criteria for Tier 2 suppliers").
   • Prioritize findings by severity (e.g., critical, major, minor).
   • Provide actionable recommendations (e.g., "Implement quarterly financial reviews for high-risk suppliers").

2. Management Response

   Present findings to factory leadership. Secure agreement on corrective actions and timelines.

3. Verification of Effectiveness

   • Schedule follow-up audits to confirm improvements.
   • Integrate learnings into future risk assessment processes.

Key Risk Factors to Scrutinize

Common Pitfalls to Avoid

• Over-Reliance on Paperwork: Verify if processes are actually implemented.
• Ignoring Tier 2 Suppliers: Assess risks beyond direct suppliers.
• Static Risk Models: Ensure adaptability to market changes.
• Lack of Supplier Collaboration: Check if suppliers share risk data transparently.

Tools & Standards

• Frameworks: ISO 31000 (risk management), OECD Due Diligence Guidance.
• Software: Supply chain risk platforms (e.g., Resilinc, Everstream Analytics).
• Certifications: Look for ISO 20400 (sustainable procurement) or EcoVadis scores.

Sample Audit Checklist

1. Is a documented supplier risk assessment process in place?
2. Are risks categorized consistently (e.g., financial, operational, ESG)?
3. Is there evidence of regular reassessments?
4. Are high-risk suppliers subject to enhanced monitoring?
5. Are corrective actions tracked and verified?
6. Are ESG risks (e.g., modern slavery) assessed?
7. Is the process reviewed annually for effectiveness?

By following this structured approach, you’ll ensure the factory’s supplier risk assessment is robust, proactive, and aligned with business resilience goals.